OpenBao - Leadership from the Ground Up

Securing the widespread adoption of AI, supporting the imminent post-quantum cryptographic migrations, and increasingly sophisticated supply chain attacks are keeping industry leaders up at night. Secrets management, cryptographic inventory, and identity platforms are critical areas of investment in 2026: these are the foundational components platform teams utilize to meet the accelerating business demands.

Teams can't just adopt unproven, unfamiliar tooling.

But at the same time, existing solutions must be ready to scale to handle the increasing load and new demands.

Secure, Community-First Secrets Management

At ControlPlane, our team has been preparing OpenBao (opens in a new tab), the open source secrets manager governed (opens in a new tab) under the Linux Foundation's (opens in a new tab) OpenSSF (opens in a new tab), from the ground up to support these new demands. OpenBao is a fork (opens in a new tab) of the familiar, tested HashiCorp Vault, but with improvements to its foundations and an ambitious roadmap (opens in a new tab). This tool gives platform teams the ability to manage secrets, provide secure cryptographic APIs, and serves as a broker between various forms of identity.

Early in the project's history, I had the foresight to push for removing many poorly maintained storage backends (opens in a new tab), many of which are still carried by HashiCorp Vault (opens in a new tab). This led to a series of core feature improvements highlighted in my recent series on the OpenBao blog (opens in a new tab): paginated lists (opens in a new tab) and transactional storage (opens in a new tab). Since these improvements were landed in 2024 as a part of OpenBao v2.1.0 (opens in a new tab), they've become fundamental to the way OpenBao works.

In implementing namespaces (opens in a new tab), a Vault Enterprise feature for multi-tenant separation, we realized that companies will need to scale their instance to keep pace with rising developer productivity and application counts. The use of transactions and paginated lists allowed namespaces to scale reliably to whatever volume your business requires.

With multi-issuer support for safer SSH CA rotation (opens in a new tab), our goal was to eliminate the inherent downtime in the existing SSH CA mount when issuing keys are rotated. By leveraging transactions, updates and migrations are now strictly atomic, significantly reducing risk during this swap.

Notably these core improvements have led to vastly increased scale (opens in a new tab) as demonstrated on the OpenBao limits page (opens in a new tab). This means we can scale to handle the management complexity as teams onboard onto a common secrets management platform while adopting agentic AI. So that when the onslaught of static and dynamic secrets requests caused by agentic consumption occurs, we'll be ready to handle the traffic efficiently.

With the reintroduction of PostgreSQL (opens in a new tab) as a supported storage backend, I also proposed a design for better operationalisation (opens in a new tab) and ensured that paginated lists and transactions were a zero-day feature for a backend with better write throughput. This type of consistent execution with an eye towards scale is demonstrated in every design ControlPlane endorses.

Our driving the use of Common Expression Language (CEL) (opens in a new tab) (a policy language used by CNCF projects like Kubernetes) for authorising (opens in a new tab) authentications in JWT (opens in a new tab) and signed certificates in PKI (opens in a new tab) let us seamlessly adopt SPIFFE JWTs for agentic identity and so much more. This shifts control over complex authorisation decisions for agentic identities from upstream developers back into the hands of teams.

Future Proofing Secrets Management for the Agentic Era

Looking forward, OpenBao's designs for strong migrations (opens in a new tab) will ensure less downtime for organisations on upgrades, ensuring 24/7 consumption in the agentic age will not be impacted by necessary security patches for the secrets management platform.

Through ControlPlane's cryptographic centre of excellence, OpenBao is primed to lead the adoption of post-quantum cryptographic algorithms (opens in a new tab), ensuring that new agentic risks do not impact organisational data security.

If you are ready to assess your secrets management estate, evaluate options for better scaling to handle the load of AI agents, or to understand more about Enterprise for OpenBao, contact our team today to discuss how we can support you and your organisation.